The first authn call only returns the `sessionToken`, with the redirect later one gets the `stateToken` and afterwards need to do the authn call again for full authentication (and mfa).
This fixes Issue https://github.com/arthepsy/pan-globalprotect-okta/issues/17 raised by @lvml.
(Note that if you need to specify a client certificate for the `vpn_url`, then most probably
you will also need to give the same certificate to the final `openconnect` call with `--certificate` via the `openconnect_args`)